Mac scareware gang evades Apple's new anti-malware defenses
Within hours of Apple's security fix, new fake security scam appears
Computerworld - The gang responsible for a month-long plague of fake Mac security software has already updated their "scareware" to evade defenses Apple put in place late Tuesday, a security company confirmed today.
"Apple's [antivirus] did not detect the new sample," said Peter James, a spokesman for Intego, a French firm that develops Mac security software.
According to James, the new malware file is identified as "mdinstall.pkg" and if installed, plants the phony MacGuard software on the victim's Mac.
Intego confirmed what ZDNet blogger Ed Bott reported earlier Wednesday, that the scammers had created a new version that wasn't detected by Apple's new defenses.
"This isn't surprising, that there's a new variant out almost as soon as Apple released its security update Tuesday," said James. "[The attackers] are following the news, they're efficient."
On Tuesday, Apple released an update for Mac OS X 10.6, aka Snow Leopard, that warns users that they've downloaded fake Mac security software and scrubs machines already infected with the scareware.
Also called "rogueware," scareware is bogus security software that claims a computer is heavily infected with worms, viruses and other malware. Once installed, the worthless program nags users with pervasive pop-ups and fake alerts until they fork over a fee. MacDefender, the generic name for the new series that targets Macs, demands $60 to $80 to cease and desist.
Intego first reported MacDefender in early May, but since then several variants have appeared, including MacGuard, which installs without requiring a password.
The new MacDefender appeared only hours after Apple issued its update yesterday, said James.
"They'll keep doing this," James predicted, referring to the cat-and-mouse game between the hackers who create MacDefender and Apple's efforts to block them.
"It's worked well enough that they're making money off it, or they wouldn't be doing this. Coming out with a new version right after the update, and a new version as soon as Apple announced it was going to release an update, shows that they're planning on staying on top of things," James said.
The move would not have surprised another researcher.
In a Tuesday interview, Chet Wisniewski, a security researcher with U.K.-based Sophos said Apple's update would either accelerate the race or the hackers would give up.
"If they keep doing [MacDefender], it implies they are succeeding at making money," said Wisniewski. "If Apple is able to stymie [MacDefender] 90% of the time or better, does that mean the bad guys will give up or up the ante?"
It seems that they've done the latter, which in James' eyes, wasn't that difficult.
"Apple's defense is signature-based," said James, talking about the antivirus tactic that relies on individual "fingerprints" of each piece of malware for detection. "Part of the new variant's code is the same, but part of it is different."
- Hands on: Apple's Mac Pro is the fastest Mac ever
- Apple CFO to retire in September after he cashes in $53M stock award
- Apple's CarPlay to spark mobile apps war in your car
- Apple retires Snow Leopard from support, leaves 1 in 5 Macs vulnerable to attacks
- Apple patches critical 'gotofail' bug with Mavericks update
- Why Apple needs a $700 MacBook Air
- Apple takes top spot in brand value computation
- Apple gets a patent for health-monitoring ear buds
- Apple shifts to hardware-first TV strategy with revamped set-top box
- iTunes is almost as big a biz as OEM Windows
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts